CVE-2017-12868
CriticalSummary
The secureCompare method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp version 1.14.13 and earlier, when used with PHP before 5.6, allows attackers to conduct session fixation attacks or possibly bypass authentication due to missing character conversions before an XOR operation.
Risk Assessment
Organizations may be exposed to attacks that allow for session hijacking or bypassing authentication mechanisms, potentially leading to unauthorized access to systems.
Recommendation
It is recommended to update SimpleSAMLphp to the latest version and to use PHP version 5.6 or newer to mitigate the risks associated with this vulnerability.
Other vulnerabilities in SimpleSAMLphp
See all- CVE-2017-12869High
The multiauth module in SimpleSAMLphp version 1.14.13 and earlier allows remote attackers to bypass authentication context restrictions and use an authentication source defined in config/authsources.php due to improper validation of user input.
- CVE-2017-12873Critical
SimpleSAMLphp versions 1.7.0 through 1.14.10 may allow attackers to obtain sensitive information, gain unauthorized access, or have unspecified other impacts by leveraging incorrect persistent NameID generation when an Identity Provider (IdP) is misconfigured.
- CVE-2026-49284High
Information disclosure vulnerability in SimpleSAMLphp before 1.18.6 and in versions 2.x before 2.4.7 and 2.5.2. An attacker can exploit missing InResponseTo validation in signed assertions to bind a response from one trusted IdP to SP state created for another IdP, bypassing routing mechanisms.
Original NVD description (English source)
The secureCompare method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.13 and earlier, when used with PHP before 5.6, allows attackers to conduct session fixation attacks or possibly bypass authentication by leveraging missing character conversions before an XOR operation.